1. The Short Answer: The Phone Compares Measurements, Not Pictures
Using a body feature to prove who you are is called biometric authentication ("bio" means life, "metric" means measurement). Apple, for example, says its Touch ID stores only a mathematical representation of a fingerprint (a set of numbers that describes it), never images of the finger itself. Other phones may work differently. [1] Its Face ID likewise turns what the camera captures into a mathematical representation and compares that with the face data saved when you set up the phone. [2]
So the lock works in two steps: measure something about you, then check how closely the new measurement matches the saved one. The rest of this article is about how each step works, and where it can go wrong.
2. How a Phone Turns a Fingertip Into Data
A fingerprint is a pattern of tiny raised lines (ridges) with valleys between them. In Apple's description of Touch ID, the sensor uses capacitive touch, a way of sensing the skin through tiny electrical signals, to take a high-resolution image of small sections of the print. [1]
The software then does two things. It sorts the print into one of three basic types: arch, loop or whorl. And it maps out finer details in the ridges, smaller than the eye can see. [1] Many fingerprint systems describe such details as points where a ridge ends or splits in two. Those details, and how they sit in relation to each other, are what get stored and compared.
With Touch ID, only a small part of the finger is read each time, and the finger is rarely placed in exactly the same way twice. That is why the match is never "identical." The phone accepts a match that is close enough, and that choice is also where mistakes can slip in (section 5).
3. How a Phone Measures the Shape of a Face
Face ID uses a special front camera system called TrueDepth. It projects thousands of invisible dots onto your face and analyzes them to build a depth map, which records how near or far each part of the face is. It also takes an infrared image. [2] Infrared light is just outside what our eyes can see, so the phone can do this without a bright flash.
A simple way to picture it: an ordinary photo is flat, while a depth map describes a three-dimensional shape, like the difference between a drawing of a nose and a nose. Apple says the depth map and infrared image are changed into a mathematical representation and compared with the saved face data. [2] The system can also adapt to changes such as wearing makeup or growing facial hair. For bigger changes, like shaving off a full beard, it asks for your passcode before updating the saved data. [2]
4. Why Fingerprints Differ From Person to Person
These locks only make sense if different people's body features really are different. Fingerprints are a good example, and in 2023 a team at the University of Edinburgh and colleagues published a study in the journal Cell on how they form. [3]
Fingerprint ridges grow before birth, spreading out from three starting places on each fingertip: under the nail, the center of the finger pad, and the crease of the joint nearest the tip. The study links three signaling molecules, called WNT, EDAR and BMP, to the formation of the ridges. The way the ridges spread from their starting points and then merge decides the overall pattern. In the team's computer models, changing the timing, locations and angles of the three starting points produced different human fingerprint patterns. [4] In other words, a print is a bit like the pattern left by ripples that started in slightly different places, so tiny differences along the way can lead to a different final design.
5. How Often Can a Stranger Unlock Someone Else's Phone?
Apple gives odds for its own systems. For Touch ID with one enrolled finger, the chance that a random person's fingerprint would match is 1 in 50,000. [1] For Face ID, the chance that a random person could unlock your phone is less than 1 in 1,000,000. [2]
Apple also says that the chance is higher for twins and for siblings who look like you, and among children under 13, because their distinct facial features might not have fully developed. [2] These numbers come from the company that makes the product, not from an independent test, and other brands use different sensors, so they should not be applied to every phone. The honest takeaway is simple: "very unlikely" is not "impossible," which is why phones also keep a passcode as a backup.
6. Why a Leaked Fingerprint Is Harder to Fix Than a Leaked Password
If someone steals your password, you choose a new one. You cannot choose a new fingertip. That is the main difference between a biometric and a password.
A real case shows why this matters. In 2015, the United States Office of Personnel Management (OPM) announced that 5.6 million people's fingerprints were stolen in a hack, more than five times the 1.1 million it first reported. OPM said that the ability to misuse fingerprint data is limited, but that this could change over time as technology evolves. [5]
One reason phone makers keep the data on the device is to reduce this risk. Apple says Touch ID data is encrypted, protected by a key available only to a separate secure part of the chip (the Secure Enclave), never stored on Apple servers and never backed up to iCloud. [1] It says the same about Face ID data. [2] That keeps the data off a company's big database, though it does not make any lock perfect.
7. Look at Your Own Fingerprint
You can check the three basic types yourself. Press a fingertip on a clean piece of paper after lightly rubbing it with a soft pencil, then press sticky tape on the smudge and stick it on white paper. Look at it with a magnifying glass and ask: is it an arch, a loop, or a whorl? Compare a few fingers, and ask a family member to compare theirs. Then you might wonder how a phone's sensor could tell all of these apart, or look up the Cell study to see how the ridges grow.